agenttesla | 7cbe7d346f86a0f771e9cd2957f588b28310251461033a1e8e1fa47513f4544c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Abbys Loader.exe

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET5C06.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SET5C06.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SET5C07.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\awealloc.sys	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET5C17.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\deviodrv.sys	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET5C07.tmp	rundll32.exe
File created	C:\Windows\system32\DRIVERS\SET5C17.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\DRIVERS\imdisk.sys	rundll32.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Abbys Loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Abbys Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Abbys Loader.exe

Executes dropped EXE 3 IoCs

pid	Process
3300	config.exe
4636	config.exe
2764	loader.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	api64.ipify.org
172	api64.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Abbys Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Abbys Loader.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\imdsksvc.exe	rundll32.exe
File opened for modification	C:\Windows\system32\SET5C2B.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET5C2D.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\imdisk.cpl	rundll32.exe
File created	C:\Windows\system32\SET5C18.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\SET5C19.tmp	rundll32.exe
File created	C:\Windows\system32\SET5C2A.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\uninstall_imdisk.cmd	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\imdisk.exe	rundll32.exe
File opened for modification	C:\Windows\system32\SET5C18.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\imdisk.exe	rundll32.exe
File created	C:\Windows\system32\SET5C2B.tmp	rundll32.exe
File created	C:\Windows\SysWOW64\SET5C2D.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET5C3D.tmp	rundll32.exe
File created	C:\Windows\SysWOW64\SET5C3D.tmp	rundll32.exe
File created	C:\Windows\system32\SET5C19.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\imdisk.cpl	rundll32.exe
File opened for modification	C:\Windows\system32\SET5C2A.tmp	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
112	Abbys Loader.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\ImDisk\config.exe	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Vhdx.dll	config.exe
File created	C:\Program Files\ImDisk\RamDiskUI.exe	config.exe
File created	C:\Program Files\ImDisk\DiscUtilsDevio.exe	config.exe
File created	C:\Program Files\ImDisk\DevioNet.dll	config.exe
File created	C:\Program Files\ImDisk\ImDiskTk-svc.exe	config.exe
File created	C:\Program Files\ImDisk\lang.txt	config.exe
File opened for modification	C:\Program Files\ImDisk\lang.txt	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Vhd.dll	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Vmdk.dll	config.exe
File created	C:\Program Files\ImDisk\ImDisk-Dlg.exe	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Core.dll	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Vdi.dll	config.exe
File created	C:\Program Files\ImDisk\ImDiskNet.dll	config.exe
File created	C:\Program Files\ImDisk\MountImg.exe	config.exe
File created	C:\Program Files\ImDisk\RamDyn.exe	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Dmg.dll	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Streams.dll	config.exe
File created	C:\Program Files\ImDisk\DiscUtils.Xva.dll	config.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\INF\SET5C2C.tmp	rundll32.exe
File created	C:\Windows\Eggsterant\eggsterant.zip	Abbys Loader.exe
File opened for modification	C:\Windows\Eggsterant\loader.exe	Abbys Loader.exe
File created	C:\Windows\Eggsterant\WindowsInput.dll	Abbys Loader.exe
File opened for modification	C:\Windows\Eggsterant\WindowsInput.dll	Abbys Loader.exe
File opened for modification	C:\Windows\Eggsterant\Guna.UI2.dll	Abbys Loader.exe
File opened for modification	C:\Windows\INF\SET5C2C.tmp	rundll32.exe
File opened for modification	C:\Windows\INF\imdisk.inf	rundll32.exe
File created	C:\Windows\Eggsterant\loader.exe	Abbys Loader.exe
File created	C:\Windows\Eggsterant\Newtonsoft.Json.dll	Abbys Loader.exe
File opened for modification	C:\Windows\Eggsterant\Newtonsoft.Json.dll	Abbys Loader.exe
File created	C:\Windows\Eggsterant\Guna.UI2.dll	Abbys Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	loader.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133465449797620541"	chrome.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\ = "Mount as ImDisk Virtual Disk"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\Icon = "\"C:\\Program Files\\ImDisk\\config.exe\""	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\Icon = "\"C:\\Program Files\\ImDisk\\config.exe\""	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command\ = "rundll32.exe imdisk.cpl,RunDLL_MountFile %L"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command\ = "rundll32.exe imdisk.cpl,RunDLL_SaveImageFile %L"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command\ = "\"C:\\Program Files\\ImDisk\\MountImg.exe\" \"%L\""	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\ = "Unmount ImDisk Virtual Disk"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\ = "Save disk contents as image file"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\ = "Mount as ImDisk Virtual Disk"	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command\ = "\"C:\\Program Files\\ImDisk\\ImDisk-Dlg.exe\" RM %L"	config.exe
Key created	\REGISTRY\USER\S-1-5-21-2419339351-1576266894-3530880589-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\command\ = "rundll32.exe imdisk.cpl,RunDLL_RemoveDevice %L"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\ = "Save disk contents as image file"	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\Icon = "\"C:\\Program Files\\ImDisk\\config.exe\""	config.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskUnmount\ = "Unmount ImDisk Virtual Disk"	config.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ImDiskMountFile\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\ImDiskSaveImage\command\ = "\"C:\\Program Files\\ImDisk\\ImDisk-Dlg.exe\" CP %L"	config.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
112	Abbys Loader.exe
3240	msedge.exe
3240	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
452	identity_helper.exe
452	identity_helper.exe
552	msedge.exe
552	msedge.exe
2816	msedge.exe
2816	msedge.exe
1072	msedge.exe
1072	msedge.exe
496	msedge.exe
496	msedge.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
4244	identity_helper.exe
4244	identity_helper.exe
112	Abbys Loader.exe
2516	msedge.exe
2516	msedge.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
4796	chrome.exe
4796	chrome.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe
112	Abbys Loader.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
692	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	Abbys Loader.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
496	msedge.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
112	Abbys Loader.exe
112	Abbys Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 4116	112	Abbys Loader.exe	78
PID 112 wrote to memory of 4116	112	Abbys Loader.exe	78
PID 4116 wrote to memory of 4372	4116	msedge.exe	79
PID 4116 wrote to memory of 4372	4116	msedge.exe	79
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3896	4116	msedge.exe	80
PID 4116 wrote to memory of 3240	4116	msedge.exe	81
PID 4116 wrote to memory of 3240	4116	msedge.exe	81
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82
PID 4116 wrote to memory of 664	4116	msedge.exe	82

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3232
- C:\Users\Admin\AppData\Local\Temp\Abbys Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Abbys Loader.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sourceforge.net/projects/imdisk-toolkit/
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa792b3cb8,0x7ffa792b3cc8,0x7ffa792b3cd8
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1780 /prefetch:2
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
      4⤵
      PID:664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,15684403899478459843,15265883783118403140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=necrum.win/dashboard/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa792b3cb8,0x7ffa792b3cc8,0x7ffa792b3cd8
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1780 /prefetch:2
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1744,4808710695128119742,7964818457338990976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
      4⤵
      PID:2500
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" baseboard get serialnumber
    3⤵
    PID:2356
- - C:\Windows\Eggsterant\loader.exe
    "C:\Windows\Eggsterant\loader.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates system info in registry
    PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_ImDiskTk-x64.zip\ImDiskTk20220826\install.bat" "
  2⤵
  PID:432
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_ImDiskTk-x64.zip\ImDiskTk20220826\install.bat" 7 "
    3⤵
    PID:756
  - - C:\Windows\system32\extrac32.exe
      extrac32.exe /e /l "C:\Users\Admin\AppData\Local\Temp\ImDisk213519.98" "C:\Users\Admin\AppData\Local\Temp\Temp1_ImDiskTk-x64.zip\ImDiskTk20220826\files.cab"
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\ImDisk213519.98\config.exe
      "C:\Users\Admin\AppData\Local\Temp\ImDisk213519.98\config.exe"
      4⤵
      Executes dropped EXE
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\ImDisk213519.98\config.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ImDisk213519.98\config.exe" /UAC "C:\Users\Admin\AppData\Local\Temp\ImDisk213519.98\config.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        
        PID:4636
      - C:\Windows\SYSTEM32\rundll32.exe
        
        rundll32 setupapi.dll,InstallHinfSection DefaultInstall 128 driver\imdisk.inf
        6⤵
        Drops file in Drivers directory
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        
        PID:3924
        
        C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        7⤵
        Checks processor information in registry
        
        PID:4520
        
        C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        8⤵
        
        PID:2008
      - C:\Windows\SYSTEM32\reg.exe
        
        reg copy HKLM\SOFTWARE\ImDisk\DriverBackup HKLM\SYSTEM\CurrentControlSet\Services\ImDisk\Parameters /f
        6⤵
        
        PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa74b59758,0x7ffa74b59768,0x7ffa74b59778
    3⤵
    PID:5060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:3408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:2
    3⤵
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4492 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4648 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:1540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:4204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4968 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5104 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:3252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4916 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:2532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1792,i,6438722806417877685,3798661936574353766,131072 /prefetch:8
    3⤵
    PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion